Today I'll show a couple of tricks to determine bandwidth of a conversation between two hosts and a trick to help quickly determine top bandwidth users on a network. To do this, download and install the massively powerful free Network Protocol Analyzer, Wireshark.
First, we'll look at how to determine the average bandwidth between two hosts. I first came across the need for this information when I was tasked to plan a move of a department from one site to another. The users of this department need to use a specialized application hosted at the original site, but bandwidth may be an issue. To test, we bought one user's computer to the second site and had him log in and use the software. Even if the test is successful, we need to know the bandwidth impact of not just one user, but of the entire department (in this case, ten users). We needed to find this one user's usage, then we could multiply by the number of users and get an approximate average bandwidth need. To find this:
1. Open Wireshark.
2. Click on Capture, then Interfaces.
3. Your available network interfaces will appear. Find the interface you wish to monitor, then click Options.
4. The Capture Options window will appear. Since we're monitoring the communication between two hosts, we only want to see the traffic between the two. Type host {IP of one host} && host {IP of other host} next to the Capture Filter button. This feature is actually really powerful, allowing you to monitor just per port, per network, exclude hosts or port or networks, etc. For a good list of capture filter options, look at The Wireshark Wiki or this site: http://home.insight.rr.com/procana/.
5. It's a good idea to save your capture to a file. To set this up, enter a location and file name next to the File field.
6. Click the Start button to start your capture.
7. At this point you'll start seeing the packets being captured. Start running your tests.
8. After you're done testing, click Capture, then click Stop. Depending on the size of the capture, it may take a minute or two for the capture to fully stop.
9. Now, click Statistics and click Summary. The Wireshark:Summary window will appear.
Here is the summary of the communications between the two hosts. In my example, the Avg bytes/sec is 4555.791, or approx 4.6Kbps. This can help you determine your bandwidth needs for an application or will help you recognize if one client is taking up more bandwidth than it should. When determining bandwidth needs, you have to realize that this is the AVERAGE bytes per second, not the maximum. There may be certain times that the host could take exceed that, such as on an application open or save. With proper testing, such as taking measurements during each section of the test, you can verify if this is the case and can help you plan accordingly.
You can also use this method to determine if a client is taking up much more bandwidth than it should. If you can capture all communications on a network, such as mirroring your WAN (or Internet) port, you can find out what host is transmitting the most packets or the most bytes. To do this:
1. Start a capture like listed above, but skip the Capture Filter.
2. Once you feel that you have an adequately sized sample, stop the capture.
3. Click Statistics and choose Conversations.
4. I typically choose the IPv4 tab.
5. You can sort by Packets or by Bytes.
In my example, you can see that the top conversation between Address A and Address B has sent many more packets and many more Bytes than the next host. This can help you find out your biggest bandwidth users and will show you whom they are talking to. I've actually used this method to find out some of my bigger users of my Internet bandwidth and was able to determine that the biggest bandwidth hog was those users listening to streaming Internet radio, which gave justification for web filtering.
Wireshark is powerful tool as shown above, but it is much more powerful if utilized well. Also to note, Wireshark was previously known as Ethereal. When searching for more information, most Ethereal information should be applicable to Wireshark.
April 04, 2008
March 01, 2008
I was setting up an old server to act as a print server today and decided to share a tip or two.
Move your print spools to another disk.
Since spooling can take up a bit of I/O, moving this to a disk other than on your system disk can help speed things up a bit. This also helped me a few years ago when I had a 12 GB system partition (remember when vendors shipped drives like that) and needed to free up some space.
1. Open the Printers and Faxes applet.
2. Click on File and Server Properties.
3. Click the Advanced tab.
4. Change the directory of the Spool Folder to the other drive.
5. Click apply.
6. Restart the Print Spooler. Open a command line and run net stop spooler && net start spooler.
Install only the DRIVERS, not the software.
I've seen people do this before, especially with HP or Dell (Lexmark) printers. When setting up a printer on a server, don't run the printer's "install" utility, don't install their special "printer monitor", and don't run any "driver install packages". Always install only the drivers. This avoids all the unnecessary services and processes running on your server. I've found that most of these programs are bulky, eat memory, and will slow down your printing. I've seen a few from the vendors I mentioned already that have memory leaks.
Beware printers on a terminal server.
Actually, don't beware of them. Just don't put them on the terminal server in the first place. Set up all your printer queues on a different server. There are several reasons for this.
1. Disk I/O is an important resource in Terminal Server. When you have 60+ users hammering the same disk at the same time, you don't need 20 print jobs trying to do the same. If you HAVE to have printer queues on the Terminal Server, follow my first tip and move the spools to another disk.
2. Memory usage is another important resource. The print queues will take up memory, but some drivers will spawn a process for each and every user on the system. This adds up quick if you have two or three of these processes per user and a large number of users.
3. If you have a limited amount of hard drive space, periods where there is a high volume of printing will make things much worse (unless you move the spools to another drive).
4. All of your users will see all of the print queues on the system. This can provide some amount of confusion for your users, and you might find them printing to the wrong printer or changing printer settings.
Printer pools and other tips
I found the article Configure IT Quick: Configure print queue servers for efficient printing informative if it's applicable for your environment.
Also see the article Get IT Done: Boost printer performance by adjusting Windows' spool file settings.
February 13, 2007
Simmons Consulting » Remote Desktop (RDP) window state - Tip on how to open your RDP sessions maximized.
January 30, 2007
Clear the Temporary Internet Files using the Windows XP Disk Cleanup utility: This article explains you how to clear the Temporary Internet Files using the Disk Cleanup utility, Automate the cleanup task, and explains you how to add a cleanup button to the Internet Explorer standard toolbar for people who need to clear the Temporary Internet Files cache very frequently.
September 09, 2006
Most of us have had a brand new computer at one time. It's a great feeling. You boot up windows and within 30 seconds you are surfing the net, checking your email, or playing your favorite game. 10 months down the road things aren't so nice anymore. You power up your computer and it seems to take forever to load.
read more | digg story
September 07, 2006
UNIX provides hundreds, if not thousands, of commands with which you can manipulate a large variety of resources available in the kernel and user space. Martin Streicher, Editor-in-Chief, Linux Magazine, looks at three essential UNIX utilities that deliver the entire Internet to your command line.
read more | digg story